PCI compliance refers to adhering to the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.
The standard was established to protect cardholder data from theft and to secure and strengthen payment card transaction systems.
Here are the main goals and requirements for PCI compliance:
Build and Maintain a Secure Network
-
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect Cardholder Data
-
- Requirement 3: Protect stored cardholder data.
- Requirement 4: Encrypt transmission of cardholder data across open, public networks.
Maintain a Vulnerability Management Program
-
- Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs.
- Requirement 6: Develop and maintain secure systems and applications.
Implement Strong Access Control Measures
-
- Requirement 7: Restrict access to cardholder data by business need-to-know.
- Requirement 8: Identify and authenticate access to system components.
- Requirement 9: Restrict physical access to cardholder data.
Regularly Monitor and Test Networks
-
- Requirement 10: Track and monitor all access to network resources and cardholder data.
- Requirement 11: Regularly test security systems and processes.
Maintain an Information Security Policy
-
- Requirement 12: Maintain a policy that addresses information security for all personnel.
It’s important to note the following about PCI compliance:
Who Must Comply?: All entities that handle credit card data, including merchants, processors, acquirers, issuers, and service providers, must be PCI compliant.
Validation Levels: Depending on the volume of transactions a company handles and how they process these transactions, they will fall into different merchant levels. Each level has its own validation requirements, ranging from completing a Self-Assessment Questionnaire (SAQ) to undergoing an onsite review by a Qualified Security Assessor (QSA).
Non-Compliance Penalties: Non-compliance can result in penalties from payment card brands (like Visa, Mastercard, etc.), increased transaction fees, and potential reputational damage. Most critically, non-compliance increases the risk of data breaches, which can have severe financial and legal ramifications.
Ensuring PCI compliance is not just about adhering to a set of rules; it’s about maintaining an ongoing commitment to data security. Given the growing sophistication of cyber threats and the potential costs associated with a data breach, achieving and maintaining PCI compliance is critical for any organization that handles credit card data.